ISO 27018 Certification – and Audit Support
Trusted by 650+ Clients
Overview: ISO 27018
ISO/IEC 27018 provides controls and guidelines for protecting PII in public cloud services where providers act as processors. Based on ISO/IEC 27002 and ISO/IEC 29100, it helps organisations assess privacy risks and secure PII, supporting both processors and controllers.
ISO 27018:2025 – What Changed, and Why the 2019 Version No Longer Counts
ISO/IEC 27018:2025 was published in August 2025 as the third edition of the standard, formally replacing and withdrawing ISO/IEC 27018:2019.
New title, new category.
The standard is no longer called a “Code of practice.” It’s now titled “Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors”.
Full realignment to ISO/IEC 27002:2022.
The 2019 edition still followed the older 2013-era ISO/IEC 27002 structure. The 2025 edition maps every control to the current four-theme structure (organizational, people, physical, technological), so gap assessments and Statements of Applicability line up with the ISO 27001:2022 controls your ISMS almost certainly already uses.
Refreshed Annex A.
The informative Annex A, “Public cloud PII processor extended control set for PII protection”, carries forward the cloud-specific requirements the standard is known for: sub-processor transparency, notification of government access requests to PII, secure erasure of temporary files, and return or disposal of PII on contract termination, now reorganized against the current control set.
New Annex B, for continuity only.
A new informative Annex B maps the 2025 controls back to their ISO/IEC 27018:2019 equivalents. It exists so organizations already certified under the 2019 text can update their Statement of Applicability without repeating a full gap analysis from scratch.
Any organization still citing “ISO 27018:2019” in its ISMS scope statement, Statement of Applicability, or customer-facing security documentation is referencing a withdrawn document.
ISO 27018 Internal Audit with Kratikal
Kratikal audits your existing ISO 27001 ISMS against the ISO/IEC 27018:2025 control set, confirming that your organization's public cloud PII handling – access, retention, disclosure, and disposal – holds up before your certification date.
Our Approach
Gap Analysis
We assess your current cloud data-handling practices against the ISO/IEC 27018:2025 controls and flag disparities with applicable PII protection laws and contractual obligations.
Policy Drafting
We draft the PII-handling policies and procedures your ISMS needs to close the identified gaps, covering consent, retention, disclosure, and sub-processor management.
ISO 27018 Implementation
We help embed the extended cloud-PII controls into your existing ISO 27001 ISMS, updating your Statement of Applicability to reflect the 2025 control set.
Internal Audit & Review
We test the implemented controls for operating effectiveness, identify findings, and recommend corrective action ahead of the certification audit.
Certification Audit Support
We prepare your team for the certification body's assessment, addressing findings so the ISO 27018 controls are certified alongside your ISO 27001 scope.
Why Do Organizations Need ISO 27018?
ISO 27018 is not legally required, but it is increasingly expected when personal data is processed in the public cloud. As enterprise buyers add cloud privacy checks to vendor assessments, demonstrating conformance with the current 2025 edition shows that your PII handling practices are up to date and not based on the withdrawn 2019 version.
Who Needs ISO 27018 Certification?
Cloud & SaaS Service Providers
Data Center, Hosting & Colocation Providers
HR Tech & Recruitment Platforms
Healthtech & Digital Health Platforms
BFSI & Fintech Firms Hosting Customer Data on Public Cloud
IT-Enabled Services (ITES), BPO & KPO Firms Processing Customer PII
Our Trust Block
Client Testimonials
We sincerely appreciate your team's professionalism and diligence throughout the ISO certification process. The structured approach and attention to compliance have been commendable. Your efforts have greatly contributed to strengthening our organization's quality and process standards.
Thanks for prompt response on the project and the follow-ups. Appreciate both Ishita and Kushagra for jumping in quickly to resolve a client-side issue with the report. We might look forward to a few more compliance projects like ISO shortly.
Benefits
Builds Client Trust
Proves PII is secured to a recognized global standard, reassuring stakeholders and prospects.
Clearer Cloud Governance
Improves transparency and accountability over how personal data is handled and shared.
Reduced Regulatory Exposure
Lowers the risk of data-protection fines by evidencing processor-level accountability and control.
Stronger Reputation
Cuts breach risk and safeguards brand trust and customer confidence over time.
FAQs
ISO/IEC 27018 is a code of practice for protecting personally identifiable information (PII) in public cloud services where the provider acts as a PII processor. It isn't independently certifiable - organizations are assessed against it as an extension of their ISO/IEC 27001 information security management system.
The 2025 edition is the third edition, replacing ISO/IEC 27018:2019. It renames the document from a "code of practice" to "guidelines," realigns every control to the ISO/IEC 27002:2022 structure, and adds a new Annex B that maps the updated controls back to the 2019 edition for continuity.
No. ISO 27018 has no standalone certification scheme. It is audited as an extension of an existing ISO/IEC 27001-based ISMS, and the resulting certificate references both standards together.
Any organization acting as a PII processor in the public cloud: SaaS and cloud platform vendors, data center and hosting providers, ITES/BPO firms, HR tech platforms, healthtech companies, and BFSI/fintech firms storing customer data on public cloud infrastructure.
Three years, matching the validity cycle of the underlying ISO 27001 certificate, with annual surveillance audits carried out by the same certification body.
The extended PII controls are reviewed within the same audit period as ISO 27001, at initial certification, then at each annual surveillance audit and the three-year recertification audit.
ISO 27017 provides cloud-specific information security controls for both cloud service providers and customers. ISO 27018 is narrower and privacy-focused, addressing only the protection of PII when a cloud provider acts as a processor. Many organizations pursue both extensions alongside a single ISO 27001 audit.
ISO 27701 is a full Privacy Information Management System (PIMS) extension to ISO 27001, covering both PII controllers and processors across a much broader control set. ISO 27018 is narrower in scope, covering cloud PII processors only, and is increasingly treated as a subset of what ISO 27701 already covers.
No. ISO 27018 supports GDPR Article 28 processor obligations by evidencing appropriate technical and organizational measures, but certification is not a substitute for a legal compliance assessment. It reduces audit friction with enterprise customers rather than replacing legal review.
Annex A adds cloud-specific PII controls not found in ISO/IEC 27002 alone, including purpose limitation for processing, notification of government access requests, secure erasure of temporary files, sub-processor transparency, and the return or disposal of PII at the end of a contract.